2

I am working on Amazon web services. Designing the custom IAM policies.

I have a user which have restricted access on the instances like he can start,stop the instances. Similarly i want to restrict the user to attach,delete specific volumes. I have created this policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "TheseActionsDontSupportResourceLevelPermissions",
"Effect": "Allow",
"Action": ["ec2:DescribeInstances","ec2:DescribeInstanceStatus","ec2:DescribeVolumeAttribute","ec2:DescribeVolumeStatus","ec2:DescribeVolumes"], ,
"Resource": "*"
},
{
"Sid": "TheseActionsSupportResourceLevelPermissions",
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:TerminateInstances",
"ec2:StopInstances",
"ec2:StartInstances",
"ec2:AttachVolume",
"ec2:DetachVolume"
],
"Resource": "arn:aws:ec2:us-west-2:AccountID:instance/instanceID",
"Resource": "arn:aws:ec2:us-west-2:AccountID:instance/instanceID",
"Resource": "arn:aws:ec2:us-west-2:AccountID:instance/instanceID",
"Resource": "arn:aws:ec2:us-east-1:123456789012:volume/volID",
"Resource": "arn:aws:ec2:us-east-1:123456789012:volume/volID",
"Resource": "arn:aws:ec2:us-east-1:123456789012:volume/volID"
}
]
}

when I apply this policy it does not show me any volumes.

I get an error:

error fetching the volume details.

Any lead is appreciated Thanks

Megha Sharma
  • 2,235
  • 8
  • 27
  • 31

1 Answers1

1

Update

The best way to test/debug IAM policies is by means of the fantastic IAM Policy Simulator (see Using the IAM Policy Simulator for the actual link and instructions). With its help, the solution below can easily be verified to be working correctly.

I recommend to add a dedicated test user to your account with no policies attached (i.e. implicit Deny All) and then using the Mode: New Policy to assemble and simulate the policy in question, e.g. for the use case at hand:

  • use two volumes and allow one via the policy, then simulate the policy with both resources, one will yield denied and the other allowed for AttachVolume and DetachVolume

Once satisfied, you can apply the assembled policy to the entities in your account and recheck via Mode: Existing Policies.

Initial Answer

I wonder how you have been able to apply this IAM policy, insofar it is syntactically invalid JSON (the Action field within the first Statement lacks any value)?

The syntax error aside, that's also the source of your problem:
As indicated by TheseActionsDontSupportResourceLevelPermissions, a few EC2 API actions do not support the comparatively new Resource-Level Permissions for EC2 and RDS Resources yet, see this note from Amazon Resource Names for Amazon EC2:

Important Currently, not all API actions support individual ARNs; we'll add support for additional API actions and ARNs for additional Amazon EC2 resources later. For information about which ARNs you can use with which Amazon EC2 API actions, as well as supported condition keys for each ARN, see Supported Resources and Conditions for Amazon EC2 API Actions.

You will find that all ec2:Describe* actions are indeed absent still from Supported Resources and Conditions for Amazon EC2 API Actions at the time of this writing. This also includes the ec2:DescribeVolume* actions, which is why you receive the error.

Fixing the first statement as outlined below should remedy the issue:

{
  "Statement": [
    {
      "Sid": "TheseActionsDontSupportResourceLevelPermissions",
      "Action": [
        "ec2:DescribeVolumeAttribute",
        "ec2:DescribeVolumeStatus",
        "ec2:DescribeVolumes"
      ],
      "Effect": "Allow",
      "Resource": "*"
    },
    {
      "Sid": "TheseActionsSupportResourceLevelPermissions",
      "Effect": "Allow",
      "Action": [
        "ec2:AttachVolume",
        "ec2:DetachVolume"
      ],
      "Resource": "arn:aws:ec2:<region>:<account number>:volume/<volume id>"
    }
  ]
}
Steffen Opel
  • 63,899
  • 11
  • 192
  • 211
  • Is this possible that the user can see all the volumes but can attach,delete a particular Volume. Also he can create volume. Is that possible? – Megha Sharma Apr 03 '14 at 10:04
  • I am waiting for the response. Kindly respond to my queries whenever u get time. Thanks – Megha Sharma Apr 04 '14 at 04:56
  • The outlined policy enables your attach/detach scenario just fine, I've updated my answer with instructions on using the IAM Policy Simulator to verify this yourself - you can also allow the creation of volumes, but of course, you do not know the resulting volume id in advance, thus can't include resp. attach/detach permissions upfront. This would require a considerably more sophisticated workflow based on tags, see e.g. section _Partial Workaround_ in my answer to [How to hide instances in EC2 based on tag - using IAM?](http://stackoverflow.com/a/18646575/45773) for the conceptual approach. – Steffen Opel Apr 04 '14 at 08:53
  • Btw., a variation of aforementioned _Partial Workaround_ more closely aligned to your use case is also shown in [Example 4. Allow users to manage particular volumes for particular instances](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-policies-for-amazon-ec2.html#ex4). – Steffen Opel Apr 04 '14 at 09:03